rendered paste bodybx_bool win_proc_get_by_cr3( bx_phy_address cr3) { bx_bool result; bx_address laddr; result = logical2linear( 0x30, 0, &laddr, cr3); KPCR tmp_kpcr; result ? result = vmem_read( laddr, sizeof( tmp_kpcr), (Bit8u*) &tmp_kpcr, cr3) : return result; KPRCB tmp_kprcb; result ? result = vmem_read( tmp_kpcr.Prcb, sizeof( tmp_kprcb), (Bit8u*) &tmp_kprcb, cr3) : return result; KTHREAD tmp_kthread; result ? result = vmem_read( tmp_kprcb.CurrentThread, sizeof( tmp_kthread), (Bit8u*) &tmp_kthread, cr3) : return result; // KTHREAD contains a KAPC_STATE struct in the ApcState field. // That in turn contains a pointer to the KPROCESS struct (contained in an EPROCESS struct) EPROCESS tmp_eprocess; result ? result = vmem_read( tmp_kthread.ApcState.Process, sizeof( tmp_eprocess), (Bit8u*) &tmp_eprocess, cr3) : return result; return result;}